Take-Two’s privacy policy sucks up your info like Kirby stuck in a vacuum machine

Take-Two Interactive has been caught silently updating the end-user license agreement (EULA) associated with Kerbal Space Program as well as several other titles on Steam, and has included some pretty eyebrow-raising changes in their recent privacy policy update that allows them to hoard all your personal information for marketing purposes internally, as well as sharing or selling it off to third parties, potentially for profit. Take-Two is not the first company to do this with software products, nor are they the only one in the games industry which compiles user data thanks to digital distribution and online services, but while reading these changes it is difficult to not feel that something sinister is afoot here. The changes have had Reddit in a buzz, and a thread on the subject has attracted more than 1,300 comments and over 16,000 upvotes, sending it straight to the front page of Reddit.

The Kerbal EULA was last updated on 22 January 2018, but Steam doesn’t really inform users that the EULA is updated for the games they own in their respective libraries – it’s always up to the user to regularly check for a new agreement or an update to an existing one. In May 2017 Take-Two bought out Kerbal’s developer, Squad, in a private sale that did not have its value disclosed. Squad now falls under the Private Division label within the company as a first-party studio.

By installing and using the Software, you consent to the information collection and usage terms set forth in this section and Licensor’s Privacy Policy, including (where applicable) (i) the transfer of any personal information and other information to Licensor, its affiliates, vendors, and business partners, and to certain other third parties, such as governmental authorities, in the U.S. and other countries located outside Europe or your home country, including countries that may have lower standards of privacy protection; (ii) the public display of your data, such as identification of your user-created content or displaying your scores, ranking, achievements, and other gameplay data on websites and other platforms; (iii) the sharing of your gameplay data with hardware manufacturers, platform hosts, and Licensor’s marketing partners; and (iv) other uses and disclosures of your personal information or other information as specified in the above-referenced Privacy Policy, as amended from time to time. If you do not want your information used or shared in this manner, then you should not use the Software.

The above paragraph isn’t that new. It’s copied verbatim from older EULAs seen in other Take-Two published titles like Civilization VI. It’s also meant to be read in conjunction with the privacy policy published on Take-Two’s website, which says the following:

Personal information is information that identifies you and that may be used to contact you online or offline. The Company collects personal information from you on a voluntary basis. When you submit personal information to the Company, it will usually take the form of: 

  • Registration for Online Services, websites, jobs, products, contests, and special events; 
  • Subscribing to newsletters or alerts; 
  • Posting in or commenting on our message boards, forums, news blogs, chat rooms, or other Online Services; 
  • Purchasing a product or services through our online stores; 
  • Purchasing downloadable content, virtual items, or virtual currency for use with our software and/or Online Services; 
  • Using “tell a friend,” “email this page,” or other E-Card features; 
  • Requesting technical support; 
  • Downloading demos, programs, or other software; 
  • Participating in polls, surveys, and questionnaires; or 
  • Otherwise through use of our software, including console products, mobile products, and personal computer products, and through the use of our online products or Online Services where personal information is required for use and/or participation. 

The types of information collected in connection with the activities listed above will vary depending on the activity. The information we collect may include personal information such as your first and/or last name, e-mail address, phone number, photo, mailing address, geolocation, or payment information. In addition, we may collect your age, gender, date of birth, zip code, hardware configuration, console ID, software products played, survey data, purchases, IP address and the systems you have played on. We may combine the information with your personal information and across other computers or devices that you may use. Prize winners may be required to provide additional information for prize fulfillment. 

The data collection doesn’t stop there. Take-Two’s privacy agreement includes the ability to give them access to your friends and followers list on Twitter and Facebook if you use these services to authenticate yourself to Take-Two’s online services, and you’re additionally tracked through other markers like usernames, console or hardware IDs if you don’t use all of Take-Two’s services, or even if you don’t use online multiplayer. You consent to all of this and more when you install games which use this privacy policy.

To its credit, the company says that they don’t share any information with law enforcement organisations unless it is expressly required, nor do they keep information you provide through support emails, use of their forums, or signing into their services with a linked account from Sony or Microsoft or Steam. It is possible to refuse to provide personal information to the company, but they note that refusal to do so “may limit your ability to participate in some activities, such as sweepstakes or the use of certain Online Services”, but this is subject to services where these records are “essential components of the services we offer you and other users”.

In addition, there’s also a clause in the policy which says where and when Take-Two will share this information with third-parties:

We may share your personal and other information with third parties in connection with an investigation of fraud, intellectual property infringements, or other activity that is illegal or may expose you or us to legal liability, including as required by law enforcement or other government officials. We also may share your personal and other information with third parties when we have reason to believe that a disclosure is necessary to address potential or actual injury or interference with our rights, property, operations, users, or others who may be harmed or may suffer loss or damage, or when we believe that disclosure is necessary to protect our rights, investigate, or enforce our policies, terms and conditions, combat fraud and/or comply with a judicial proceeding, court order, or legal process served on the Company. In addition, your personal and other information may be disclosed to a potential or actual successor or assign in connection with a proposed or consummated merger, acquisition, reorganization, bankruptcy, or other similar event involving all or a portion of the Company, the Company’s customer information may be transferred to our successor or assign.

It looks like Take-Two is comfortable with asking their users to submit almost all of the useful information pertinent to allow more effective marketing and research to be done, but the company has strict points where this can legally occur with third-parties outside of the company. Sure, having all of this information collected on us, sometimes without our knowledge, is unsettling, but it looks like the fears of the Kerbal Space Program subreddit are unfounded.

Or, at the very least, they have merit, but Take-Two’s own legal policies seem to prevent the dystopian nightmares that Redditors are imagining. Let’s hope it stays that way.